API Security Project

1–30 of 41

Hello and welcome to Google Group of the OWASP API Security Project

Our project page is here: https://www.owasp.org/index.php/OWASP_API_Security_Project

The project itself is maintained on a GitHub repo and waiting for issues to be opened and general contributions. Please make sure to read the How to Contribute guide before you do.

For a quick start, you can see the latest temporary draft: https://github.com/OWASP/API-Security/tree/develop/2019/en/dist.

Best Regards,

Erez Yalon & Inon Shkedy

OWASP API Security Project Leaders

0 selected

Alycia DuBry, … W Rodriguez5

10/4/23

Loving the info ! On Thu, Jun 1, 2023 at 2:25 PM 'Alycia DuBry' via API Security Project <

unread,

Loving the info ! On Thu, Jun 1, 2023 at 2:25 PM 'Alycia DuBry' via API Security Project <

10/4/23

Bjoern Kimminich, … hehacks (hehacks)6

9/6/23

Mapping of API Security Top 10 to Juice Shop challenges

Hi Erez, One kind request, can you provide me access to delete my previous email, I thought its

unread,

Mapping of API Security Top 10 to Juice Shop challenges

Hi Erez, One kind request, can you provide me access to delete my previous email, I thought its

9/6/23

Paulo Silva, … miguel quintero3

5/7/23

OWASP API Security Top 10 2023 Release Candidate

Thanks for sharing Paulo. What is the planned release date ? ..thanks.. rgds, Miguel On Tuesday,

unread,

OWASP API Security Top 10 2023 Release Candidate

Thanks for sharing Paulo. What is the planned release date ? ..thanks.. rgds, Miguel On Tuesday,

5/7/23

Inon Shkedy, … Paulo Silva3

11/3/22

Call for Data - OWASP API Top Ten 2022

Hi Jim, We're trying to depict the API security state-of-the-art since the latest (and first) API

unread,

Call for Data - OWASP API Top Ten 2022

Hi Jim, We're trying to depict the API security state-of-the-art since the latest (and first) API

11/3/22

Jason Kent, Inon Shkedy2

8/2/22

OWASP API Top Ten 2022

As I mentioned in the post - we will soon publish official calls for opinions and data, here in the

unread,

OWASP API Top Ten 2022

As I mentioned in the post - we will soon publish official calls for opinions and data, here in the

8/2/22

Jim Weiler, … Owen Rubel12

3/10/22

GraphQL and Bot protection

Hi Owen, I couldn't understand your comment of Jan 5, 2022, 7:58:48 PM, or the code snippets at

unread,

GraphQL and Bot protection

Hi Owen, I couldn't understand your comment of Jan 5, 2022, 7:58:48 PM, or the code snippets at

3/10/22

尹普, Jason Kent2

12/1/21

How can we automately detect security risk base on OWSAP API Security Top 10?

There are quite a few options here. Hand reading specs and looking at your endpoints and doing a line

unread,

How can we automately detect security risk base on OWSAP API Security Top 10?

There are quite a few options here. Hand reading specs and looking at your endpoints and doing a line

12/1/21

Dark Brains Decoder Access, … David Biesack5

10/19/21

Learning API security from scratch

I am so grateful to have joined to this group. I know it will take million miles to be an expert. A

unread,

Learning API security from scratch

I am so grateful to have joined to this group. I know it will take million miles to be an expert. A

10/19/21

Manish Pandey, … Paulo Silva4

10/11/21

Hindi Translation

Hi guys, To start the Hindi translation, please visit the following link and press the "New

unread,

Hindi Translation

Hi guys, To start the Hindi translation, please visit the following link and press the "New

10/11/21

em mazzon, … alton.c...@owasp.org9

9/30/21

Understood. I put a couple sentences out of order that introduced 'firewall' before I made

unread,

Understood. I put a couple sentences out of order that introduced 'firewall' before I made

9/30/21

david...@gmail.com, … Owen Rubel9

3/30/21

MindAPI announcement and call for collaboration

I should also reply that one should do smoke tests too as part of the devops and build process. Owen

unread,

MindAPI announcement and call for collaboration

I should also reply that one should do smoke tests too as part of the devops and build process. Owen

3/30/21

oscar arias, … Paulo Silva6

3/16/21

API Security Top 10 in SP (Spanish)

Terrific! I was translating files into API-Security/2019/src/, but I see that Leonel is advanced, I

unread,

API Security Top 10 in SP (Spanish)

Terrific! I was translating files into API-Security/2019/src/, but I see that Leonel is advanced, I

3/16/21

Paulo Silva, … prjam...@gmail.com4

2/18/21

GraphQL API Security

On Wed, Feb 17, 2021 at 5:41 PM Nathan Aw <nathan...@gmail.com> wrote: > > Hi Paulo,

unread,

GraphQL API Security

On Wed, Feb 17, 2021 at 5:41 PM Nathan Aw <nathan...@gmail.com> wrote: > > Hi Paulo,

2/18/21

Inon Shkedy, … Isabelle Mauny8

2/15/21

~ crAPI beta announcement ~

Hello Amit, We have also created a bunch of free resources you may want to use : https://apisecurity.

unread,

~ crAPI beta announcement ~

Hello Amit, We have also created a bunch of free resources you may want to use : https://apisecurity.

2/15/21

Erez Yalon, … David Biesack11

12/8/20

Announcing the Release of the OWASP API Security Top 10 - 2019 Edition

I'm also looking for training on secure system design/coding that addresses OWASP API Top Ten (

unread,

Announcing the Release of the OWASP API Security Top 10 - 2019 Edition

I'm also looking for training on secure system design/coding that addresses OWASP API Top Ten (

12/8/20

Wilson Alberto Torres

11/9/20

Is there any public data set with API-related network traffic?

Hello Community! Is there any public data set with API-related network traffic? Appreciate your

unread,

Is there any public data set with API-related network traffic?

Hello Community! Is there any public data set with API-related network traffic? Appreciate your

11/9/20

Oren Sternheim, … Paulo Silva5

10/19/20

Thanks for the heads up: it was fixed. On Mon, Oct 19, 2020 at 7:48 PM Raphael Hagi <raphael.

unread,

Thanks for the heads up: it was fixed. On Mon, Oct 19, 2020 at 7:48 PM Raphael Hagi <raphael.

10/19/20

Ailton da SIlva dos Santos Filhos

10/18/20

New approaches to detect Broken Level Authorization attacks

Hi everyone, Recently, new approaches to detect BOLA attacks are emerging, such as the ones described

unread,

New approaches to detect Broken Level Authorization attacks

Hi everyone, Recently, new approaches to detect BOLA attacks are emerging, such as the ones described

10/18/20

LUIS SAIZ GIMENO

10/1/20

New OWASP Incubating project: API Check

Hi all, We have just contributed to OWASP our project API Check https://owasp.org/www-project-

unread,

New OWASP Incubating project: API Check

Hi all, We have just contributed to OWASP our project API Check https://owasp.org/www-project-

10/1/20

Testing, … erez....@owasp.org8

9/12/20

Tool-name: API FUZZ

Interesting, thanks for the lead! Erez Yalon OWASP API Security Project Co-Leader Email: erez.yalon@

unread,

Tool-name: API FUZZ

Interesting, thanks for the lead! Erez Yalon OWASP API Security Project Co-Leader Email: erez.yalon@

9/12/20

Salt Security, Jason Kent3

6/3/20

Gartner thinks Salt Security is Cool 😎

My complete apologies. This was an automated email that somehow had this DL as a contact. I am on the

unread,

Gartner thinks Salt Security is Cool 😎

My complete apologies. This was an automated email that somehow had this DL as a contact. I am on the

6/3/20

Augusto Aguirre

5/20/20

main security vulnerabilities of AJAX and how to deal with them?

I read many nice things about the advantages of using AJAX architecture, but how about the weaknesses

unread,

main security vulnerabilities of AJAX and how to deal with them?

I read many nice things about the advantages of using AJAX architecture, but how about the weaknesses

5/20/20

Ailton da SIlva dos Santos Filhos, … Dmitry Sotnikov9

5/5/20

Traditional vs. Modern Web Application

Local OWASP meetups and DevSecOps events can also be good. Lots of them are now gone online.

unread,

Traditional vs. Modern Web Application

Local OWASP meetups and DevSecOps events can also be good. Lots of them are now gone online.

5/5/20

5/3/20

[translations] Spanish translation review

Hi, We're looking for Spanish speakers who can help *reviewing* OWASP API Security Top 10 2019

unread,

[translations] Spanish translation review

Hi, We're looking for Spanish speakers who can help *reviewing* OWASP API Security Top 10 2019

5/3/20

SP, Paulo Silva2

4/8/20

Test API project...

Hi, If you look into What's Next For Developers section [1] you'll find there our

unread,

Test API project...

Hi, If you look into What's Next For Developers section [1] you'll find there our

4/8/20

irvan hendrik, … Nathan Aw7

3/1/20

API Categorization (suggestion)

Think the differentiation might be potentially useful as there are obvious benefits to

unread,

API Categorization (suggestion)

Think the differentiation might be potentially useful as there are obvious benefits to

3/1/20

Raphael Hagi, Paulo Silva4

2/27/20

Portuguese (Brazil) Translation

Hi Raphael, Here's what I do: 1. Preview the Markdown file in Browser (HTML) 2. Copy&Paste to

unread,

Portuguese (Brazil) Translation

Hi Raphael, Here's what I do: 1. Preview the Markdown file in Browser (HTML) 2. Copy&Paste to

2/27/20

Joshua Maddux, … Dmitry Sotnikov14

2/2/20

Proposal for top 10: Inadvertently Encouraging Vulnerabilities in External Systems

OK, happy to contribute when the project starts. Le dim. 2 févr. 2020 à 07:09, <erez.yalon@owasp.

unread,

Proposal for top 10: Inadvertently Encouraging Vulnerabilities in External Systems

OK, happy to contribute when the project starts. Le dim. 2 févr. 2020 à 07:09, <erez.yalon@owasp.

2/2/20

1/30/20

Can OAuth 2.0 scope be leveraged and/or further enhanced to deter Broken Object Level Authorization?

Hello all, Can OAuth 2.0 authorized scopes of token be leveraged and/or further enhanced to deter

unread,

Can OAuth 2.0 scope be leveraged and/or further enhanced to deter Broken Object Level Authorization?

Hello all, Can OAuth 2.0 authorized scopes of token be leveraged and/or further enhanced to deter

1/30/20

1/13/20

About learning in API TESTING OR HACKING

Can anyone share me any writeups of api hacking or testing! In short i want to learn ALL about API

unread,

About learning in API TESTING OR HACKING

Can anyone share me any writeups of api hacking or testing! In short i want to learn ALL about API

1/13/20

Search

Clear search

Close search

Google apps

Main menu